CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Category Discount Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpcd_save_discount() function in all versions up to, and including, 4.12. This makes it possible for unauthenticated attackers to modify product category discounts that could lead to loss of revenue.
Explanation of Vulnerability in Simple Terms
Simple Discount Rules for WooCommerce versions 4.12 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify discount rules. An attacker can change discount configurations without logging in or having any special permissions. This affects the integrity of pricing and promotional settings on affected WooCommerce stores.
What an attacker can do
Modify or create discount rules without authentication.
Potential impact on your site
Attackers can alter discount rules, potentially causing revenue loss or customer confusion through unauthorized pricing changes.
Conditions required to exploit
Network access to the WooCommerce site; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
